3

We host multiple apps, on different app servers. What we have is

HAProxy -> App Servers

The App servers can be anything from PHP on Apache to Java app in glassfish. So we use haproxy to expose 1 IP and 1 port to the internet and then also load balance the various app servers, each project get's two app servers, and those two get's balanced against each other.

What we want to do now is, put Varnish infront of HAProxy to cache all traffic, and return it, before it hits HAproxy and get's routed to whatever app server.

Problem is I get a 503 from varnish to haproxy, but if I point varnish to one of the app servers directly it works perfectly. Anyone have any ideas?

1 Answer 1

2

I had a similar problem, not too long ago - and the cause turned out to be SELinux.

If HAProxy is running on a privileged port (below 1024), but your app servers are running on higher, unprivileged ports, the following scenario is quite plausible.

The SELinux configuration of some setups (e.g. a default CentOS) will prevent Varnish from connecting to a privileged port. If you have auditd running, you can verify this in your audit log.

For instance, on a clean install of CentOS 6.2, (when my backend server is running on port 81):

grep varnish /var/log/audit/audit.log:

type=AVC msg=audit(1331500393.450:25): avc: denied { name_connect } for pid=1276 comm="varnishd" dest=81 scontext=unconfined_u:system_r:varnishd_t:s0 tcontext=system_u:object_r:reserved_port_t:s0 tclass=tcp_socket

The current state of SELinux enforcement can be determined with:

cat /selinux/enforce

(Where 1 is enforcing, and 0 is permissive).

If the above appears to be your problem, set SELinux to temporarily permissive and confirm:

echo 0 >/selinux/enforce

If you confirm that this is, in fact, your problem, you can either use audit2allow -a -w (part of the policycoreutils-python package on CentOS) to analyze your audit log and generate the necessary rules, or you can try the following:

setsebool -P varnishd_connect_any 1

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .